# cve.now: Withastro The newest entries naming Withastro as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-114128](https://cve.now/CVE-2026-114128.md): Astro: Reflected/Stored XSS via unescaped \/\ tag content in JSX/MDX rendering (CVSS 6.5) - [CVE-2026-114127](https://cve.now/CVE-2026-114127.md): Astro: Arbitrary CSS injection in Astro View Transitions (CVSS 2.3) - [CVE-2026-102984](https://cve.now/CVE-2026-102984.md): Astro: Malformed port in the Host header can crash the Node adapter (CVSS 8.2) - [CVE-2026-102983](https://cve.now/CVE-2026-102983.md): Astro: Netlify Image CDN allowlist bypass enables SSRF (CVSS 6.3) - [CVE-2026-84376](https://cve.now/CVE-2026-84376.md): Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base (CVSS 6.3) - [CVE-2026-73424](https://cve.now/CVE-2026-73424.md): Astro: Unauthenticated path override in the @astrojs/vercel ISR function (CVSS 6.5) - [CVE-2026-73425](https://cve.now/CVE-2026-73425.md): @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped (CVSS 3.7) - [CVE-2026-73423](https://cve.now/CVE-2026-73423.md): Astro: composable \`astro/hono\` pipeline bypasses \`security.checkOrigin\` when \`middleware()\` is absent or misordered (CVSS 5.1) - [CVE-2026-73422](https://cve.now/CVE-2026-73422.md): Astro: Reflected XSS via unescaped View Transition animation properties (CVSS 5.3) - [CVE-2026-59730](https://cve.now/CVE-2026-59730.md): @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect (CVSS 2.1) - [CVE-2026-59728](https://cve.now/CVE-2026-59728.md): @astrojs/rss: XML Injection via Unescaped RSS Feed Fields (CVSS 4.3) - [CVE-2026-59727](https://cve.now/CVE-2026-59727.md): Astro: Cross-site scripting via unescaped transition:\* directive values on hydrated islands (CVSS 2.1) - [CVE-2026-59729](https://cve.now/CVE-2026-59729.md): Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) (CVSS 5.1) - [CVE-2026-59731](https://cve.now/CVE-2026-59731.md): Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch (CVSS 8.2) - [CVE-2026-54299](https://cve.now/CVE-2026-54299.md): Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) (CVSS 7.5) - [CVE-2026-54298](https://cve.now/CVE-2026-54298.md): Astro: XSS via Unescaped Attribute Names in Spread Props (CVSS 4.2) - [CVE-2026-50146](https://cve.now/CVE-2026-50146.md): Astro: Reflected XSS via unescaped slot name (CVSS 7.1) - [CVE-2026-54300](https://cve.now/CVE-2026-54300.md): @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config (CVSS 5.3) - [CVE-2026-45028](https://cve.now/CVE-2026-45028.md): Astro: Server island encrypted parameters vulnerable to cross-component replay (CVSS 2.9) - [CVE-2026-41322](https://cve.now/CVE-2026-41322.md): @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed (CVSS 5.3) - [CVE-2026-41321](https://cve.now/CVE-2026-41321.md): @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint (CVSS 2.2) - [CVE-2026-41067](https://cve.now/CVE-2026-41067.md): Astro: XSS via incomplete \`\\` sanitization in \`define:vars\` allows case-insensitive and whitespace-based bypass (CVSS 6.1) - [CVE-2026-33769](https://cve.now/CVE-2026-33769.md): Astro: Remote allowlist bypass via unanchored matchPathname wildcard (CVSS 2.9) - [CVE-2026-33768](https://cve.now/CVE-2026-33768.md): Astro: Unauthenticated Path Override via \`x-astro-path\` / \`x\_astro\_path\` (CVSS 6.5) - [CVE-2026-29772](https://cve.now/CVE-2026-29772.md): Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands (CVSS 5.9) - [CVE-2026-27829](https://cve.now/CVE-2026-27829.md): Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize (CVSS 6.5) - [CVE-2026-27729](https://cve.now/CVE-2026-27729.md): Astro has memory exhaustion DoS due to missing request body size limit in Server Actions (CVSS 5.9) - [CVE-2026-25545](https://cve.now/CVE-2026-25545.md): Astro has Full-Read SSRF in error rendering via Host: header injection (CVSS 6.9) - [CVE-2025-66202](https://cve.now/CVE-2025-66202.md): Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 (CVSS 6.5) - [CVE-2025-64765](https://cve.now/CVE-2025-64765.md): Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values (CVSS 6.9) - [CVE-2025-64764](https://cve.now/CVE-2025-64764.md): Astro is vulnerable to Reflected XSS via the server islands feature (CVSS 7.1) - [CVE-2025-65019](https://cve.now/CVE-2025-65019.md): Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /\_image endpoint (CVSS 5.4) - [CVE-2025-64757](https://cve.now/CVE-2025-64757.md): Astro Development Server is Vulnerable to Arbitrary Local File Read (CVSS 3.5) - [CVE-2025-64745](https://cve.now/CVE-2025-64745.md): Astro development server error page vulnerable to reflected Cross-site Scripting (CVSS 2.7) - [CVE-2025-64525](https://cve.now/CVE-2025-64525.md): Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass (CVSS 6.5) - [CVE-2025-59837](https://cve.now/CVE-2025-59837.md): astro allows bypass of image proxy domain validation leading to SSRF and potential XSS (CVSS 7.2) - [CVE-2025-61925](https://cve.now/CVE-2025-61925.md): Astro's \`X-Forwarded-Host\` is reflected with no validation (CVSS 6.5) - [CVE-2025-58179](https://cve.now/CVE-2025-58179.md): Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /\_image endpoint (CVSS 7.2) - [CVE-2025-55303](https://cve.now/CVE-2025-55303.md): Unauthorized third-party images in Astro’s \_image endpoint (CVSS 6.9) - [CVE-2025-55207](https://cve.now/CVE-2025-55207.md): @astrojs/node's trailing slash handling causes open redirect issue (CVSS 5.5) - [CVE-2025-54793](https://cve.now/CVE-2025-54793.md): Astro: Duplicate trailing slash feature can lead to Open Redirects (CVSS 5.5) - [CVE-2024-56159](https://cve.now/CVE-2024-56159.md): Server source code is exposed to the public if sourcemaps are enabled (CVSS 7.8) - [CVE-2024-56140](https://cve.now/CVE-2024-56140.md): Bypass of CSRF Middleware in Astro (CVSS 5.9) - [CVE-2024-47885](https://cve.now/CVE-2024-47885.md): astro's client-side router has DOM Clobbering Gadget that leads to XSS (CVSS 5.9) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/withastro Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.